analyze-experiment
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the
tpcCLI tool using a pipe-to-bash command (curl -fsSL https://cli.promptingco.com/install.sh | bash). This targets a domain associated with the skill's author to configure the necessary environment for the skill. - [COMMAND_EXECUTION]: The skill utilizes local shell commands to execute the
tpcCLI for experiment data retrieval and uses headless Chrome or Chromium for generating PDF reports from HTML templates. - [EXTERNAL_DOWNLOADS]: The skill uses a CLI tool that connects to the vendor's platform to download experiment data, including signals, task results, and execution logs.
- [PROMPT_INJECTION]: The skill processes untrusted external data (experiment transcripts and logs) to generate analysis reports, which presents a surface for indirect prompt injection.
- Ingestion points: Data is ingested via the
tpc sim run logsandtpc sim experiment resultscommands inSKILL.mdandworkflows/analyze-experiment.md. - Boundary markers: The instructions do not specify the use of delimiters or boundary markers when interpolating log data into the generation prompts.
- Capability inventory: The skill has the capability to execute shell commands (
tpc,google-chrome) and perform file system operations. - Sanitization: No explicit sanitization or validation of the ingested log content is described in the skill's workflows.
Audit Metadata